---
description: Row fetch limit
keywords:
  - hasura
  - docs
  - permissions
  - rules
  - fetch-limit
sidebar_position: 40
---

import Thumbnail from '@site/src/components/Thumbnail';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Row Fetch Limit

## Introduction

Limit the number of rows returned in a response on `select` operations.

<Tabs groupId="user-preference" className="api-tabs">
<TabItem value="console" label="Console">

You can set a row fetch limit on the Hasura Console in **Data -> [table] -> Permissions -> select -> Row select 
permissions -> Limit number of rows** as per the image below:

<Thumbnail 
  src="/img/auth/authorization_row-fetch-limit_2-16-1.png" 
  alt="Row fetch limit" 
  width="450px" 
/>

</TabItem>
<TabItem value="cli" label="CLI">

You can set a row fetch limit for a table in the `metadata -> databases -> [database-name] -> tables -> 
[table-name].yaml` file, eg:

```yaml {13}
- table:
    schema: public
    name: users
  select_permissions:
    - role: user
      permission:
        columns:
          - id
          - name
        filter:
          user_id:
            _eq: X-Hasura-User-Id
        limit: 1
```

Apply the Metadata by running:

```bash
hasura metadata apply
```

</TabItem>
<TabItem value="api" label="API">

You can set a row fetch limit for a table when using the
[permissions Metadata API](/api-reference/metadata-api/permission.mdx). Example using a Postgres db:

```http {18}
POST /v1/metadata HTTP/1.1
Content-Type: application/json
X-Hasura-Role: admin

{
   "type": "pg_create_select_permission",
   "args": {
      "source": "<db_name>",
      "table": "users",
      "role": "user",
      "permission": {
         "columns": "*",
         "filter": {
            "id": {
               "_eq": "X-Hasura-User-Id"
            }
         },
         "limit": 1
      }
   }
}
```

</TabItem>
</Tabs>

In the above example, this configuration restricts the number of accessible rows (_based on the row permission_:
`{"id":{"_eq":"X-Hasura-User-Id"}}`) to 1.

Setting row fetch limits is useful for preventing abuse of your API especially if it is exposed to the public. You
can [also configure other limits](/security/security-best-practices.mdx#limit-the-api).